Privacy Policy
Last updated: July 26, 2026
Data Controller
TokenShift, based in Paris, France, is the data controller for personal data collected through this website. Contact: contact@tokenshift.ai
Data We Collect
When you use our contact form, we collect your name, email address, company name, sector, and the content of your message. This data is collected solely to respond to your inquiry and evaluate potential engagements.
We measure our audience with Umami, a self-hosted analytics tool that sets no cookies, stores no IP address and identifies no one. It runs on our own server in France, its data is never shared, and it is deleted after 13 months. Because it cannot identify you, it runs without asking for your consent.
We also use HubSpot to follow up on contact requests. HubSpot does set cookies (__hstc, __hssc, __hssrc, hubspotutk) and therefore only loads if you accept it in the banner shown on your first visit. Refusing costs you nothing: the site works identically, and any HubSpot cookie already set is deleted.
Legal Basis for Processing
We process your personal data based on your consent (Article 6(1)(a) GDPR) when you submit the contact form, and on our legitimate interest (Article 6(1)(f) GDPR) to respond to business inquiries.
Expert Network expressions of interest
TokenShift, a brand of ACS, is the controller for the information you submit here. It is used for one purpose only: reviewing expressions of interest in the independent expert network. The legal basis is your consent, which you may withdraw at any time without affecting what was done before. Only the TokenShift people responsible for that review can see your record. The information is kept in our customer relationship platform and delivered by our transactional email provider, both acting as processors; where a processor operates outside the European Economic Area, the transfer relies on the standard contractual clauses adopted by the European Commission. We keep an expression of interest for up to twenty-four months after our last exchange with you, then delete it. You can ask for access, correction, deletion, restriction or portability, or object to the processing, by writing to contact@tokenshift.ai, and we answer within the period set by European data protection law. No automated decision is made about you.
Event Registrations
When you register for one of our sessions, we collect your first and last name, work email address, company, role, and the optional answer you give to the question asked on the registration form.
We ask for two separate consents and we keep them separate. The first covers that session only — confirmation, reminders and the connection link — and is what allows us to register you. The second, which is optional and never pre-ticked, covers our monthly note and invitations to future sessions. Giving the first authorises nothing beyond that one event.
A third consent, optional and never pre-ticked, lets you receive the confirmation and a reminder by SMS before the session. It is the only case in which we ask for a mobile number; that number is used for those messages about that session only, never for prospecting, and is kept for the same period as the rest of the registration. SMS are sent through Brevo, our sending provider.
Every email we send about a session carries a one-click unsubscribe link that needs no account and no password. Using it stops all further email about that session immediately.
Sessions are recorded for one purpose only: producing a short written summary of the arguments, in which no participant is named, quoted or identifiable. The operator presenting the case validates that summary in writing before anything is published; without their validation, nothing is published. The recording itself is never published, never shared outside the session, and is deleted once the summary is validated.
Registration data is retained for 12 months after the session. Marketing consent is retained until you withdraw it.
Our email delivery provider records whether a message was opened and whether a link in it was clicked, and rewrites the links in our emails so that it can. We instruct it not to attribute those events to you individually: they are counted in aggregate only. The unsubscribe link works whether or not you allow images to load.
Data Retention
Contact form submissions are retained for the duration necessary to process your inquiry and for a maximum of 24 months. You may request deletion at any time.
Your Rights
Under GDPR, you have the right to access, rectify, delete, or restrict the processing of your personal data. You also have the right to data portability and to withdraw consent at any time. To exercise these rights, contact contact@tokenshift.ai.
Data Transfers
Your data is stored on servers located in the European Union. Our own infrastructure and our analytics never leave it.
Two of our processors are established in the United States. HubSpot hosts our customer relationship data in its European region, and Google Meet hosts the sessions we run online. Both may therefore give their US parent company access to personal data. These transfers are covered by the European Commission’s standard contractual clauses, and both providers are certified under the EU–US Data Privacy Framework.
We transfer personal data outside the EU/EEA in no other case, and never for advertising purposes.
Supervisory Authority
If you believe your data protection rights have been violated, you may file a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertes) at www.cnil.fr.